CVE Intelligence

Presenton vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Presenton products: 1 record(s), with severity, exploitation and fixes.

Presenton 1

Exploited only (KEV) →

CVE-2026-58446 Medium · 6.5 CWE-306 Jun 30, 2026
Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint
Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).